CVE-2026-47487: 
Triton Inference Server vulnerability analysis and mitigation

CVE-2026-47487 is a path traversal vulnerability (CWE-22) in NVIDIA Triton Inference Server for Linux that allows a local, low-privileged user to read, write to, or modify files outside the intended model repository by supplying a crafted path in the model name field to the Triton MLflow plugin. It affects all versions of NVIDIA Triton Inference Server up to and including version 26.02 on Linux. The vulnerability was disclosed on August 4, 2026, with NVD initial analysis completed on August 17, 2026. NVD assigns a CVSS v3.1 base score of 7.1 (High), while NVIDIA's own CNA scoring rates it 4.4 (Medium) (GitHub Advisory, NVIDIA Advisory).

The root cause is improper neutralization of path traversal sequences (CWE-22) in the Triton MLflow plugin's handling of the model name parameter. When a user submits a model name containing directory traversal sequences (e.g., ../../), the plugin fails to restrict the resulting file path to the designated model repository directory, allowing file system operations to reach arbitrary locations on the host. Exploitation requires local access and low-level privileges, with no user interaction needed. No public proof-of-concept code has been identified at this time (GitHub Advisory, NVIDIA Advisory).

Successful exploitation allows a local attacker to read sensitive files outside the model repository (high confidentiality impact per NVD scoring), potentially exposing credentials, configuration files, or proprietary model data. The attacker may also write to or modify arbitrary files accessible to the Triton service account, which could disrupt service availability and constitute a denial of service condition. Integrity impact is assessed as none by both NVD and NVIDIA's CNA, though file modification capability is noted in the description (GitHub Advisory, NVIDIA Advisory).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code as of the time of disclosure. CISA's SSVC assessment classifies exploitation as "none" and the attack as non-automatable with partial technical impact. The EPSS score is approximately 0.163–0.184%, placing it in the 8th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, NVIDIA Advisory).

1. Gain local access: Obtain a low-privileged local account on a Linux system running NVIDIA Triton Inference Server with the MLflow plugin enabled (versions up to and including 26.02).
2. Identify the MLflow plugin endpoint: Locate the Triton server's model management API or MLflow plugin interface, typically accessible via the Triton HTTP/gRPC API.
3. Craft a malicious model name: Construct a model name containing path traversal sequences such as ../../etc/passwd or ../../sensitive/config to reference files outside the model repository.
4. Submit the request: Send a request to the Triton MLflow plugin using the crafted model name, triggering the plugin to perform file read, write, or modification operations on the targeted path.
5. Retrieve or manipulate target files: Depending on the operation triggered, read sensitive files (e.g., credentials, configuration) or overwrite files to cause denial of service or further privilege escalation (GitHub Advisory, NVIDIA Advisory).

• Logs: Triton Inference Server access logs showing model name parameters containing ../ or URL-encoded equivalents (%2e%2e%2f) in MLflow plugin requests; file access errors or unexpected file paths in server logs.
• File System: Unexpected access timestamps on sensitive files outside the model repository (e.g., /etc/, /home/, application config directories) coinciding with Triton service activity; new or modified files in directories not associated with model storage.
• Process: Triton server process accessing file paths outside the designated model repository directory as observed via auditd or inotifywait monitoring tools.

NVIDIA has released a patch addressing this vulnerability; users should update NVIDIA Triton Inference Server to a version beyond 26.02 as referenced in the August 2026 security bulletin. As interim mitigations, administrators should restrict file system permissions on the model repository and surrounding directories to limit the scope of files accessible by the Triton service account. Additionally, consider restricting or disabling the MLflow plugin in sensitive environments until patching is complete, and enforce least-privilege principles for accounts with access to the Triton server (NVIDIA Advisory, GitHub Advisory).